"""Shared fixtures for the auth enforcement tests.

The `valid_jwt` fixture mints a real QA access token using ows-account's
`jwtauth[testing]` tooling: it pulls a test user and an Auth0 app credential
from AWS Secrets Manager and performs an Auth0 password-grant login.

Requirements to actually mint a token:
- AWS credentials for the account holding the `qa/ows-account-integration-test/*`
- network access to `qa-orchard.auth0.com`.
"""

import pytest
from jwtauth.testing import (
    JwtAuthSecretsManager,
    SecretLookupInfo,
    login_from_secrets_manager,
)

# Secret lookup for the minted token. Borrowed from ows-account's
# integration-test user for now — swap these for a graphql-router-owned test
# user + Auth0 app when one exists.
TOKEN_ENVIRONMENT = 'qa'
TOKEN_SERVICE_NAME = 'graphql-router-integration-test'
USER_CREDENTIALS_SECRET = 'GRAPHQL_ROUTER_TEST_USER_CREDENTIALS'
AUTH0_APP_CREDENTIALS_SECRET = 'SETTINGS_AUTH0_APP_CREDENTIALS'


@pytest.fixture(scope='session')
def valid_jwt() -> str:
    """A valid QA access token."""
    try:
        return login_from_secrets_manager(
            get_user_creds_args=SecretLookupInfo(
                environment=TOKEN_ENVIRONMENT,
                service_name=TOKEN_SERVICE_NAME,
                secret_name=USER_CREDENTIALS_SECRET,
            ),
            get_auth0_creds_args=SecretLookupInfo(
                environment=TOKEN_ENVIRONMENT,
                service_name=TOKEN_SERVICE_NAME,
                secret_name=AUTH0_APP_CREDENTIALS_SECRET,
            ),
            secrets_manager=JwtAuthSecretsManager(),
        )
    except Exception as exc:  # noqa: BLE001 - creds/network failure -> fail
        pytest.fail(f'Could not mint a QA token (need awsume + network): {exc}')